Subject: [BEHAVE] Response of firewalls and middleboxes to TCP SYN packets that are ECN-Capable?

From: Sally Floyd <[email-masked]>
Date: Thu, 2 Aug 2007 14:36:32 -0700

In the TCPM working group, my co-authors and I are finishing up a
draft on adding ECN-capability to TCP's SYN/ACK packets
("http://tools.ietf.org/html/draft-ietf-tcpm-ecnsyn").

Dave Thaler gave a report at the March IETF on the problems that
regular TCP data packets can encounter from routers or middleboxes
along the path
("http://www3.ietf.org/proceedings/07mar/slides/tsvarea-3/sld6.htm")

The point of this email is to ask if anyone knows anything about
specific problems that TCP SYN/ACK packets might encounter from the
network if the ECN field in the IP header is marked as ECN-Capable
(ECT) or Congestion Experienced (CE), over and above the problems
that are already known about for TCP data packets.  I am sending
this email to this mailing list because it was suggested by someone
at the TCPM working group last week.

Any feedback that anyone might have would be appreciated.

Many thanks,
- Sally
http://www.icir.org/floyd/

_______________________________________________
Behave mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/behave

---

From: Rémi Denis-Courmont <[email-masked]>
Date: Wed, 8 Aug 2007 16:52:58 +0300

> at the TCPM working group last week.

I remember having to disable ECN on my desktop PC to be able to reach some 
websites at all. I am not aware of any specific additionnal problem with 
SYN/ACK. I would expect that be the result of broken firewall/router 
implementations that discard any packet with unknown IP header flags, 
regardless of the transport header.

That's pure guessing though.

-- 
Rémi Denis-Courmont

---

From: Sally Floyd <[email-masked]>
Date: Sun, 12 Aug 2007 21:32:54 -0700

Remi -

> regardless of the transport header.

Many thanks for the feedback.  I will add that to the draft.

I have an old paper, "Measuring Interactions Between Transport
Protocols and Middleboxes" ("http://www.icir.org/tbit/", Figure 1)
that shows that there are many paths where the TCP SYN exchange
doesn't complete if the SYN packet contains a known or unknown IP
Option...

- Sally

------------------------------------------------------------------------ 
------------------------------------------